@rikalabs/akter 0.1.0-alpha.0

package/dist/runtime/fleet/subscribe.d.ts

@@ -0,0 +1,42 @@
+import { Effect, Stream } from "effect";
+import { SqlClient } from "effect/sql";
+import { ActorError } from "../../errors/actor.ts";
+import { type Caller } from "../../identity/caller.ts";
+import type { AccessRequest } from "../../policies/access.ts";
+import type { WatchResult } from "../members.ts";
+import { type ResolvedView } from "./maintainer.ts";
+/** One subscription to a fleet view, for the caller's own tenant. */
+export interface FleetRequest {
+    readonly view: string;
+    readonly caller: Caller;
+    readonly tenant: string;
+    /** Equality filters on group columns by key, compared with each column's text form. */
+    readonly filter: Readonly<Record<string, string>>;
+    readonly limit: number;
+    /** The credential's expiry in epoch milliseconds, which ends the subscription. */
+    readonly expiresAt: number | undefined;
+}
+/** The most subscriptions one view has on one runner. */
+export declare const FLEET_SUBSCRIPTIONS = 1000;
+/**
+ * The fleet subscriptions of one runner. A view with subscribers has one
+ * poller, which reads its `status` and `applied_lsn` once a second however
+ * many subscribe; a subscription reruns its page query only when that state
+ * changed, and sends a page only when its rows or staleness differ from the
+ * last one it sent. `asOf` alone moving on is not sent: a lower `asOf` only
+ * proves less, never something false.
+ * A subscription is authorized when it opens (`kind: "fleet"`, `command` the
+ * view) and again every `reauthorizeMs` of the source's actor type
+ * (`kind: "reauthorize"`, `of: "fleet"`), and ends at the credential's
+ * expiry. Its `ref` names the caller's tenant and the view's source actor
+ * type, with the view as its id, because a fleet read spans every actor of
+ * the type. The page query runs in a tenant transaction, as the tenant role
+ * when row-level security is on.
+ */
+export declare const fleetSubscriptions: (options: {
+    readonly views: ReadonlyArray<ResolvedView>;
+    readonly role: string | undefined;
+    readonly permitted: (request: AccessRequest) => Effect.Effect<boolean>;
+    readonly reauthorizeMs: (actorType: string) => number;
+}) => Effect.Effect<(request: FleetRequest) => Effect.Effect<Stream.Stream<WatchResult, ActorError, never>, ActorError, never>, never, import("effect/Scope").Scope | SqlClient.SqlClient>;
+export type FleetSubscribe = Effect.Success<ReturnType<typeof fleetSubscriptions>>;

package/dist/runtime/fleet/subscribe.js

@@ -0,0 +1,147 @@
+import { Clock, Effect, Schema, Stream, SubscriptionRef } from "effect";
+import { SqlClient } from "effect/sql";
+import { ActorError, ActorUnavailable, InvalidInput, RunnerAtCapacity, Unauthorized, } from "../../errors/actor.js";
+import { ActorRef } from "../../identity/caller.js";
+import { inTenant } from "../database/tenancy.js";
+import { FleetHooks } from "./maintainer.js";
+import { FLEET_PAGE_LIMIT } from "../../client/fleet-page.js";
+/** The most subscriptions one view has on one runner. */
+export const FLEET_SUBSCRIPTIONS = 1000;
+/** How often a runner reads the state of each view it has subscribers of. */
+const POLL_INTERVAL = "1 second";
+const PageRow = Schema.Struct({
+    status: Schema.String,
+    as_of: Schema.NullOr(Schema.String),
+    rows: Schema.String,
+});
+const decodeRows = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Array(Schema.Record(Schema.String, Schema.Json))));
+const encodeResult = Schema.encodeEffect(Schema.fromJsonString(Schema.Struct({
+    value: Schema.Struct({
+        asOf: Schema.NullOr(Schema.String),
+        stale: Schema.Boolean,
+        rows: Schema.Array(Schema.Record(Schema.String, Schema.Json)),
+    }),
+})));
+const encodeContent = Schema.encodeEffect(Schema.fromJsonString(Schema.Struct({
+    stale: Schema.Boolean,
+    rows: Schema.Array(Schema.Record(Schema.String, Schema.Json)),
+})));
+const identifier = (name) => `"${name.replaceAll('"', '""')}"`;
+const denied = (code) => ActorError.make({ reason: Unauthorized.make({ code }) });
+/**
+ * The fleet subscriptions of one runner. A view with subscribers has one
+ * poller, which reads its `status` and `applied_lsn` once a second however
+ * many subscribe; a subscription reruns its page query only when that state
+ * changed, and sends a page only when its rows or staleness differ from the
+ * last one it sent. `asOf` alone moving on is not sent: a lower `asOf` only
+ * proves less, never something false.
+ * A subscription is authorized when it opens (`kind: "fleet"`, `command` the
+ * view) and again every `reauthorizeMs` of the source's actor type
+ * (`kind: "reauthorize"`, `of: "fleet"`), and ends at the credential's
+ * expiry. Its `ref` names the caller's tenant and the view's source actor
+ * type, with the view as its id, because a fleet read spans every actor of
+ * the type. The page query runs in a tenant transaction, as the tenant role
+ * when row-level security is on.
+ */
+export const fleetSubscriptions = Effect.fnUntraced(function* (options) {
+    const sql = yield* SqlClient.SqlClient;
+    const scope = yield* Effect.scope;
+    const hooks = yield* FleetHooks;
+    const pollers = new Map();
+    for (const resolved of options.views) {
+        const name = resolved.view.name;
+        const state = yield* SubscriptionRef.make(undefined);
+        const poller = { state, subscribers: 0 };
+        pollers.set(name, poller);
+        const poll = Effect.gen(function* () {
+            if (poller.subscribers === 0)
+                return;
+            yield* hooks.poll(name);
+            const [row] = yield* sql `
+        SELECT status, applied_lsn::text AS applied FROM actor_fleet_views WHERE view_name = ${name}`;
+            if (row !== undefined)
+                yield* SubscriptionRef.set(state, row);
+        });
+        yield* poll.pipe(Effect.catchCause((cause) => Effect.logWarning("Fleet view poll failed", cause)), Effect.andThen(Effect.sleep(POLL_INTERVAL)), Effect.forever, Effect.forkIn(scope));
+    }
+    const page = (resolved, request) => {
+        const { view } = resolved;
+        const derived = `${identifier(resolved.derivedSchema)}.${identifier(view.tableName.split(".").at(-1))}`;
+        const keys = view.groupBy;
+        const columns = [
+            ...keys.map((key, index) => `d.${identifier(view.groupColumns[index])} AS ${identifier(key)}`),
+            ...view.aggregates.map(({ key }) => `d.${identifier(key)}`),
+        ];
+        const filters = Object.entries(request.filter);
+        const order = keys.map((key) => `r.${identifier(key)}`).join(", ");
+        const conditions = filters.map(([key], index) => `AND d.${identifier(view.groupColumns[keys.indexOf(key)])}::text = $${index + 3}`);
+        const statement = `SELECT v.status, v.applied_lsn::text AS as_of,
+        coalesce((SELECT jsonb_agg(to_jsonb(r) ORDER BY ${order})::text FROM (
+          SELECT ${columns.join(", ")} FROM ${derived} d
+          WHERE d.tenant_id = $2 ${conditions.join(" ")}
+          ORDER BY ${keys.map((_, index) => `d.${identifier(view.groupColumns[index])}`).join(", ")}
+          LIMIT ${request.limit}) r), '[]') AS rows
+      FROM actor_fleet_views v WHERE v.view_name = $1`;
+        return hooks.page(view.name).pipe(Effect.andThen(sql.unsafe(statement, [
+            view.name,
+            request.tenant,
+            ...filters.map(([, value]) => value),
+        ])), inTenant({ sql, role: options.role, tenant: request.tenant }), Effect.catchTag("SqlError", (cause) => Effect.fail(ActorError.make({ reason: ActorUnavailable.make({ cause }) }))), Effect.flatMap((rows) => Schema.decodeUnknownEffect(PageRow)(rows[0]).pipe(Effect.flatMap((row) => Effect.map(decodeRows(row.rows), (decoded) => ({
+            asOf: row.as_of,
+            stale: row.status !== "ready",
+            rows: decoded,
+        }))), Effect.flatMap((result) => Effect.all({
+            value: encodeResult({ value: result }),
+            content: encodeContent({ stale: result.stale, rows: result.rows }),
+        })), Effect.orDie)));
+    };
+    const subscribe = Effect.fnUntraced(function* (request) {
+        const resolved = options.views.find(({ view }) => view.name === request.view);
+        const poller = pollers.get(request.view);
+        if (resolved === undefined || poller === undefined)
+            return yield* ActorError.make({ reason: InvalidInput.make({ code: "unknown_route" }) });
+        const keys = resolved.view.groupBy;
+        for (const key of Object.keys(request.filter))
+            if (!keys.includes(key))
+                return yield* ActorError.make({ reason: InvalidInput.make({ code: "decode" }) });
+        if (!Number.isInteger(request.limit) || request.limit < 1 || request.limit > FLEET_PAGE_LIMIT)
+            return yield* ActorError.make({ reason: InvalidInput.make({ code: "decode" }) });
+        const actorType = resolved.view.source.owner ?? resolved.view.source.name;
+        const asked = {
+            caller: request.caller,
+            ref: ActorRef.make({ tenant: request.tenant, actor: actorType, id: request.view }),
+            command: request.view,
+        };
+        const access = (kind) => options.permitted(kind === "fleet" ? { ...asked, kind } : { ...asked, kind, of: "fleet" });
+        if (!(yield* access("fleet")))
+            return yield* denied("access_denied");
+        if (request.expiresAt !== undefined && (yield* Clock.currentTimeMillis) >= request.expiresAt)
+            return yield* denied("expired");
+        if (poller.subscribers >= FLEET_SUBSCRIPTIONS)
+            return yield* ActorError.make({ reason: RunnerAtCapacity.make({}) });
+        const run = (value) => ({ version: undefined, value });
+        const pages = SubscriptionRef.changes(poller.state).pipe(Stream.changesWith((a, b) => a?.status === b?.status && a?.applied === b?.applied), Stream.mapEffect(() => page(resolved, request)), Stream.changesWith((a, b) => a.content === b.content), Stream.map(({ value }) => run(value)));
+        const reauthorizeMs = options.reauthorizeMs(actorType);
+        const watchdog = Effect.gen(function* () {
+            while (true) {
+                const now = yield* Clock.currentTimeMillis;
+                const wait = request.expiresAt === undefined
+                    ? reauthorizeMs
+                    : Math.min(reauthorizeMs, Math.max(0, request.expiresAt - now));
+                yield* Effect.sleep(wait);
+                if (request.expiresAt !== undefined &&
+                    (yield* Clock.currentTimeMillis) >= request.expiresAt)
+                    return yield* denied("expired");
+                if (!(yield* access("reauthorize")))
+                    return yield* denied("access_denied");
+            }
+        });
+        const counted = Effect.acquireRelease(Effect.sync(() => {
+            poller.subscribers += 1;
+        }), () => Effect.sync(() => {
+            poller.subscribers -= 1;
+        }));
+        return Stream.unwrap(Effect.as(counted, pages)).pipe(Stream.merge(Stream.fromEffect(watchdog), { haltStrategy: "either" }));
+    });
+    return subscribe;
+});

package/dist/runtime/index.d.ts

@@ -0,0 +1,66 @@
+import { layer } from "./layer.ts";
+import { serve } from "../serve/layer.ts";
+import { make } from "../serve/auth.ts";
+import { jwt } from "../serve/jwt.ts";
+import { assertion } from "../serve/assertion/verify.ts";
+/** Runtime construction: actor execution and authenticated protocol routes. */
+export declare const Actors: {
+    layer: typeof layer;
+    serve: typeof serve;
+};
+/** Authentication providers for one served runtime. `none` is an explicit public opt-out. */
+export declare const Auth: {
+    none: import("./index.ts").AuthProvider<never>;
+    make: typeof make;
+    jwt: typeof jwt;
+    assertion: typeof assertion;
+};
+export type { ServeOptions } from "../serve/layer.ts";
+export type { AuthProvider, AuthRequest, Authenticated, Binding } from "../serve/auth.ts";
+export { ASSERTION_SKEW_MS, AssertionClaims, AssertionKey, AssertionKeySet, KeyRefreshClaims, MAX_ASSERTION_SECONDS, } from "../serve/assertion/verify.ts";
+export type { AssertionOptions } from "../serve/assertion/verify.ts";
+export { actorErrorBody, closeCodeOf, statusOf } from "../protocol/wire.ts";
+export { Database } from "./layer.ts";
+export { Runner } from "./runner.ts";
+export type { SocketRunnerOptions } from "./runner.ts";
+export type { MutualTlsOptions } from "./peering/transport.ts";
+export type { RunnerCredentials } from "./peering/credentials.ts";
+export { RunnerAuthority } from "./peering/authority.ts";
+export type { IssueOptions } from "./peering/authority.ts";
+export { DataDirLocked, DataDirVersion } from "../errors/database.ts";
+export type { Options } from "./layer.ts";
+export { RuntimeControl } from "./drain.ts";
+export type { DrainReport, Readiness } from "./drain.ts";
+export { checkWorkflows, formatIncompatibility } from "./workflows/compatibility.ts";
+export type { Incompatibility } from "./workflows/compatibility.ts";
+export { Inspector } from "./inspector/layer.ts";
+export type { InspectorOptions } from "./inspector/layer.ts";
+export { Telemetry } from "./telemetry/routes.ts";
+export type { TelemetryOptions } from "./telemetry/routes.ts";
+export { DefectLog, DefectRecord, DefectRecords } from "./telemetry/defects.ts";
+export { TelemetrySampler } from "./telemetry/sampler.ts";
+export { Metrics } from "./telemetry/metrics.ts";
+export { UsageAccounting } from "./telemetry/usage.ts";
+export type { UsageAccountingService, UsageCommands, UsageRead } from "./telemetry/usage.ts";
+export { SpanNames } from "./telemetry/spans.ts";
+export { Operators } from "./operators/routes.ts";
+export type { OperatorsOptions } from "./operators/routes.ts";
+export { OperatorAuth } from "./operators/auth.ts";
+export { Capability, OperatorAction, OperatorGrant } from "./operators/grants.ts";
+export { AuditRecord } from "./operators/audit.ts";
+export { Seed, SeedJson } from "./operators/seed.ts";
+export { checkPayloads, clearPayloads, formatPayloadProblem } from "./payloads/versions.ts";
+export type { ClearResult, PayloadProblem } from "./payloads/versions.ts";
+export { AdoptionRefused } from "./adoption/target.ts";
+export { formatAdoptionPlan, planAdoption } from "./adoption/plan.ts";
+export type { AdoptionPlan } from "./adoption/plan.ts";
+export { adoptionWriters, formatObservedWriter, observeAdoption } from "./adoption/observe.ts";
+export type { ObservedWriter } from "./adoption/observe.ts";
+export { backfillAdoption, formatBackfill } from "./adoption/backfill.ts";
+export type { BackfillResult } from "./adoption/backfill.ts";
+export { adoptionStatus, formatAdoptionStatus } from "./adoption/status.ts";
+export type { AdoptionStatus } from "./adoption/status.ts";
+export { enforceAdoption, formatEnforce, releaseAdoption } from "./adoption/enforce.ts";
+export type { EnforceResult } from "./adoption/enforce.ts";
+export { FleetSetupRefused, rebuildFleetView, setupFleet } from "./fleet/setup.ts";
+export type { FleetSetup } from "./fleet/setup.ts";

package/dist/runtime/index.js

@@ -0,0 +1,37 @@
+import { layer } from "./layer.js";
+import { serve } from "../serve/layer.js";
+import { make, none } from "../serve/auth.js";
+import { jwt } from "../serve/jwt.js";
+import { assertion } from "../serve/assertion/verify.js";
+/** Runtime construction: actor execution and authenticated protocol routes. */
+export const Actors = { layer, serve };
+/** Authentication providers for one served runtime. `none` is an explicit public opt-out. */
+export const Auth = { none, make, jwt, assertion };
+export { ASSERTION_SKEW_MS, AssertionClaims, AssertionKey, AssertionKeySet, KeyRefreshClaims, MAX_ASSERTION_SECONDS, } from "../serve/assertion/verify.js";
+export { actorErrorBody, closeCodeOf, statusOf } from "../protocol/wire.js";
+export { Database } from "./layer.js";
+export { Runner } from "./runner.js";
+export { RunnerAuthority } from "./peering/authority.js";
+export { DataDirLocked, DataDirVersion } from "../errors/database.js";
+export { RuntimeControl } from "./drain.js";
+export { checkWorkflows, formatIncompatibility } from "./workflows/compatibility.js";
+export { Inspector } from "./inspector/layer.js";
+export { Telemetry } from "./telemetry/routes.js";
+export { DefectLog, DefectRecord, DefectRecords } from "./telemetry/defects.js";
+export { TelemetrySampler } from "./telemetry/sampler.js";
+export { Metrics } from "./telemetry/metrics.js";
+export { UsageAccounting } from "./telemetry/usage.js";
+export { SpanNames } from "./telemetry/spans.js";
+export { Operators } from "./operators/routes.js";
+export { OperatorAuth } from "./operators/auth.js";
+export { Capability, OperatorAction, OperatorGrant } from "./operators/grants.js";
+export { AuditRecord } from "./operators/audit.js";
+export { Seed, SeedJson } from "./operators/seed.js";
+export { checkPayloads, clearPayloads, formatPayloadProblem } from "./payloads/versions.js";
+export { AdoptionRefused } from "./adoption/target.js";
+export { formatAdoptionPlan, planAdoption } from "./adoption/plan.js";
+export { adoptionWriters, formatObservedWriter, observeAdoption } from "./adoption/observe.js";
+export { backfillAdoption, formatBackfill } from "./adoption/backfill.js";
+export { adoptionStatus, formatAdoptionStatus } from "./adoption/status.js";
+export { enforceAdoption, formatEnforce, releaseAdoption } from "./adoption/enforce.js";
+export { FleetSetupRefused, rebuildFleetView, setupFleet } from "./fleet/setup.js";

package/dist/runtime/inspector/http.d.ts

@@ -0,0 +1,19 @@
+import { Effect, Option } from "effect";
+import { type HttpServerRequest, HttpServerResponse } from "effect/http";
+import type { ActorError } from "../../errors/actor.ts";
+/** A 404 with the `NotFound` body. */
+export declare const notFoundResponse: () => HttpServerResponse.HttpServerResponse;
+/** Answers a found value as JSON and an absent one as a 404. */
+export declare const foundOrNotFound: (found: Option.Option<unknown>) => HttpServerResponse.HttpServerResponse;
+/**
+ * Refuses a browser page on another origin before its credentials are read,
+ * so an operator's cookie or token can't be spent by a page they visit.
+ */
+export declare const refuseCrossOrigin: (request: HttpServerRequest.HttpServerRequest) => ActorError | Effect.Effect<void, never, never>;
+/**
+ * Finishes an operator or inspector route: an `ActorError` is answered as the
+ * wire error, a defect is logged under `failure` and answered with an opaque
+ * 500 naming only its trace, and no answer is cached, since every answer is
+ * bound to one authenticated principal.
+ */
+export declare const operatorResponse: (failure: string) => <R>(response: Effect.Effect<HttpServerResponse.HttpServerResponse, ActorError, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse, never, R>;

package/dist/runtime/inspector/http.js

@@ -0,0 +1,36 @@
+import { Effect, Option, Schema } from "effect";
+import { Headers, HttpServerResponse } from "effect/http";
+import { isSameOrigin } from "../../serve/layer.js";
+import { Defect } from "../../protocol/wire.js";
+import { actorErrorResponse, invalidInput } from "../../serve/wire.js";
+/** The body of a 404: the tenant has nothing of that name. */
+const NotFound = Schema.TaggedStruct("NotFound", {});
+/** A 404 with the `NotFound` body. */
+export const notFoundResponse = () => HttpServerResponse.jsonUnsafe(NotFound.make({}), { status: 404 });
+/** Answers a found value as JSON and an absent one as a 404. */
+export const foundOrNotFound = (found) => Option.match(found, {
+    onNone: notFoundResponse,
+    onSome: (value) => HttpServerResponse.jsonUnsafe(value),
+});
+/**
+ * Refuses a browser page on another origin before its credentials are read,
+ * so an operator's cookie or token can't be spent by a page they visit.
+ */
+export const refuseCrossOrigin = (request) => {
+    const origin = Headers.get(request.headers, "origin");
+    return Option.isSome(origin) && !isSameOrigin({ request, origin: origin.value })
+        ? invalidInput("origin_not_allowed")
+        : Effect.void;
+};
+const traceId = Effect.currentSpan.pipe(Effect.map((span) => span.traceId), Effect.orElseSucceed(() => "0".repeat(32)));
+/**
+ * Finishes an operator or inspector route: an `ActorError` is answered as the
+ * wire error, a defect is logged under `failure` and answered with an opaque
+ * 500 naming only its trace, and no answer is cached, since every answer is
+ * bound to one authenticated principal.
+ */
+export const operatorResponse = (failure) => (response) => response.pipe(Effect.catch(actorErrorResponse), Effect.catchCause((cause) => Effect.gen(function* () {
+    const trace = yield* traceId;
+    yield* Effect.logError(failure, cause);
+    return HttpServerResponse.jsonUnsafe(Defect.make({ traceId: trace }), { status: 500 });
+})), Effect.map((answered) => HttpServerResponse.setHeaders(answered, { "cache-control": "no-store" })));

package/dist/runtime/inspector/layer.d.ts

@@ -0,0 +1,46 @@
+import { HttpRouter } from "effect/http";
+import { SqlClient } from "effect/sql";
+import { type AuthProvider } from "../../serve/auth.ts";
+/** Configuration for `Inspector.serve`. */
+export interface InspectorOptions<R> {
+    /**
+     * Authenticates every inspector request. The inspector reads only the
+     * authenticated principal's tenant, and every actor of it, so give it an
+     * operator's provider, not the one end users call `Actor.serve` with.
+     */
+    readonly auth: AuthProvider<R>;
+    /** Prefix for every route. Default `"/inspector"`. */
+    readonly basePath?: `/${string}`;
+}
+/**
+ * Serves read-only JSON over the `durable` inspection views as routes on the
+ * application's `HttpRouter`. A request from another browser origin is
+ * refused with `403` before its credentials are read, and a credential over
+ * 8 KiB with `413` before its provider runs; each other request is
+ * authenticated per request, never cached, since the tenant is the one fact
+ * every read trusts. Every read is filtered to the principal's tenant and runs
+ * in a read-only transaction.
+ *
+ * - `GET /overview`: the view catalog, the tenant's row counts and its soonest timer.
+ * - `GET /actors?type&prefix&afterType&afterId&limit`: actors, one keyset page
+ *   at a time, optionally those whose `type/id` address starts with `prefix`.
+ * - `GET /actor?type&id&limit`: one actor's state, receipts with the events
+ *   each committed, events, outbox, jobs, dead letters, and workflows with steps.
+ * - `GET /actor-types?type&prefix&after&limit`: actor types with their actor
+ *   counts, optionally one type or those whose name starts with `prefix`.
+ * - `GET /receipts?type&id&outcome&afterExpiresAtMs&afterType&afterId&afterCommandId&limit`:
+ *   receipts of one actor, one type or the tenant, the latest expiry first.
+ * - `GET /latest-events?type&id&after&limit`: one actor's newest event of each name.
+ * - `GET /timeline?type&id&beforeSequence&beforeKind&limit`: one actor's events
+ *   and the commands that emitted them, newest first.
+ * - `GET /job-types?after&limit`: pending jobs and dead letters by job name.
+ * - `GET /outbox`, `/jobs`, `/dead-letters?afterDeadAtMs&afterJobId`,
+ *   `/workflows?status=open|all|running|suspended|finished|completed|failed&afterStartedAtMs&afterExecutionId`:
+ *   tenant-wide lists; the paged ones answer the `next` cursor to pass back.
+ */
+declare const serve: <R = never>(options: InspectorOptions<R>) => import("effect/Layer").Layer<never, never, HttpRouter.HttpRouter | SqlClient.SqlClient | Exclude<R, import("effect/Scope").Scope>>;
+/** The read-only inspector: `serve` mounts its routes. */
+export declare const Inspector: {
+    serve: typeof serve;
+};
+export {};

package/dist/runtime/inspector/layer.js

@@ -0,0 +1,180 @@
+import { Effect, Schema } from "effect";
+import { HttpRouter } from "effect/http";
+import { SqlClient } from "effect/sql";
+import { ActorError, Unauthorized } from "../../errors/actor.js";
+import { Anonymous, User } from "../../identity/caller.js";
+import { CREDENTIAL_BYTES, oversizedCredential, readsCookies, withinLimits, } from "../../serve/auth.js";
+import { invalidInput, undecodable } from "../../serve/wire.js";
+import { foundOrNotFound, operatorResponse, refuseCrossOrigin } from "./http.js";
+import * as Queries from "./queries.js";
+const DEFAULT_LIMIT = 50;
+const Limit = Schema.FiniteFromString.check(Schema.isInt(), Schema.isBetween({ minimum: 1, maximum: Queries.MAX_LIMIT })).pipe(Schema.withDecodingDefaultTypeKey(Effect.succeed(DEFAULT_LIMIT)));
+const PageParams = Schema.Struct({ limit: Limit });
+const Millis = Schema.FiniteFromString.check(Schema.isInt(), Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }));
+/** Refuses a keyset cursor that names only some of its fields, which would silently restart the list. */
+const whole = (...keys) => Schema.makeFilter((params) => {
+    const named = keys.filter((key) => params[key] !== undefined).length;
+    return named === 0 || named === keys.length || `${keys.join(", ")} go together`;
+});
+const ActorsParams = Schema.Struct({
+    limit: Limit,
+    type: Schema.optional(Schema.String),
+    prefix: Schema.optional(Schema.NonEmptyString),
+    afterType: Schema.optional(Schema.String),
+    afterId: Schema.optional(Schema.String),
+}).check(whole("afterType", "afterId"));
+const ActorParams = Schema.Struct({ limit: Limit, type: Schema.String, id: Schema.String });
+const ActorTypesParams = Schema.Struct({
+    limit: Limit,
+    type: Schema.optional(Schema.String),
+    prefix: Schema.optional(Schema.NonEmptyString),
+    after: Schema.optional(Schema.String),
+});
+const JobTypesParams = Schema.Struct({ limit: Limit, after: Schema.optional(Schema.String) });
+const LatestEventsParams = Schema.Struct({
+    ...ActorParams.fields,
+    after: Schema.optional(Schema.String),
+});
+const TimelineParams = Schema.Struct({
+    ...ActorParams.fields,
+    beforeSequence: Schema.optional(Millis),
+    beforeKind: Schema.optional(Schema.Literals(["command", "event"])),
+}).check(whole("beforeSequence", "beforeKind"));
+const ReceiptsParams = Schema.Struct({
+    limit: Limit,
+    type: Schema.optional(Schema.String),
+    id: Schema.optional(Schema.String),
+    outcome: Schema.optional(Schema.Literals(["Success", "Failure"])),
+    afterExpiresAtMs: Schema.optional(Millis),
+    afterType: Schema.optional(Schema.String),
+    afterId: Schema.optional(Schema.String),
+    afterCommandId: Schema.optional(Schema.String),
+}).check(Schema.makeFilter(({ type, id }) => id === undefined || type !== undefined || "id needs type"), whole("afterExpiresAtMs", "afterType", "afterId", "afterCommandId"));
+const DeadLettersParams = Schema.Struct({
+    limit: Limit,
+    afterDeadAtMs: Schema.optional(Millis),
+    afterJobId: Schema.optional(Schema.String),
+}).check(whole("afterDeadAtMs", "afterJobId"));
+const WorkflowsParams = Schema.Struct({
+    limit: Limit,
+    status: Schema.optional(Schema.Literals(["open", "all", "running", "suspended", "finished", "completed", "failed"])),
+    afterStartedAtMs: Schema.optional(Millis),
+    afterExecutionId: Schema.optional(Schema.String),
+}).check(whole("afterStartedAtMs", "afterExecutionId"));
+const isPrincipal = Schema.is(Schema.Union([User, Anonymous]));
+/**
+ * Serves read-only JSON over the `durable` inspection views as routes on the
+ * application's `HttpRouter`. A request from another browser origin is
+ * refused with `403` before its credentials are read, and a credential over
+ * 8 KiB with `413` before its provider runs; each other request is
+ * authenticated per request, never cached, since the tenant is the one fact
+ * every read trusts. Every read is filtered to the principal's tenant and runs
+ * in a read-only transaction.
+ *
+ * - `GET /overview`: the view catalog, the tenant's row counts and its soonest timer.
+ * - `GET /actors?type&prefix&afterType&afterId&limit`: actors, one keyset page
+ *   at a time, optionally those whose `type/id` address starts with `prefix`.
+ * - `GET /actor?type&id&limit`: one actor's state, receipts with the events
+ *   each committed, events, outbox, jobs, dead letters, and workflows with steps.
+ * - `GET /actor-types?type&prefix&after&limit`: actor types with their actor
+ *   counts, optionally one type or those whose name starts with `prefix`.
+ * - `GET /receipts?type&id&outcome&afterExpiresAtMs&afterType&afterId&afterCommandId&limit`:
+ *   receipts of one actor, one type or the tenant, the latest expiry first.
+ * - `GET /latest-events?type&id&after&limit`: one actor's newest event of each name.
+ * - `GET /timeline?type&id&beforeSequence&beforeKind&limit`: one actor's events
+ *   and the commands that emitted them, newest first.
+ * - `GET /job-types?after&limit`: pending jobs and dead letters by job name.
+ * - `GET /outbox`, `/jobs`, `/dead-letters?afterDeadAtMs&afterJobId`,
+ *   `/workflows?status=open|all|running|suspended|finished|completed|failed&afterStartedAtMs&afterExecutionId`:
+ *   tenant-wide lists; the paged ones answer the `next` cursor to pass back.
+ */
+const serve = (options) => HttpRouter.use(Effect.fnUntraced(function* (router) {
+    const basePath = (options.basePath ?? "/inspector").replace(/\/+$/, "");
+    const context = yield* Effect.context();
+    const sql = yield* SqlClient.SqlClient;
+    const authenticate = (request) => Effect.gen(function* () {
+        if (oversizedCredential({
+            provider: options.auth,
+            headers: request.headers,
+            limit: CREDENTIAL_BYTES,
+        }))
+            return yield* invalidInput("too_large");
+        const authenticated = yield* options.auth
+            .authenticate({
+            headers: request.headers,
+            cookies: readsCookies(options.auth) ? request.cookies : {},
+        })
+            .pipe(Effect.provideContext(context), Effect.mapError((reason) => ActorError.make({ reason })));
+        if (!isPrincipal(authenticated.caller) || !withinLimits(authenticated))
+            return yield* ActorError.make({
+                reason: Unauthorized.make({ code: "invalid_credentials" }),
+            });
+        return authenticated.tenant;
+    });
+    const route = (path, params, read) => router.add("GET", `${basePath}${path}`, (request) => Effect.gen(function* () {
+        yield* refuseCrossOrigin(request);
+        const tenant = yield* authenticate(request);
+        const decoded = yield* HttpRouter.schemaParams(params).pipe(Effect.mapError(undecodable));
+        return foundOrNotFound(yield* Queries.readOnly(tenant)(read(tenant, decoded)).pipe(Effect.provideService(SqlClient.SqlClient, sql), Effect.orDie));
+    }).pipe(operatorResponse("Inspector request failed")));
+    yield* route("/overview", Schema.Struct({}), (tenant) => Effect.asSome(Queries.overview({ tenant })));
+    yield* route("/actors", ActorsParams, (tenant, { limit, type, prefix, afterType, afterId }) => Effect.asSome(Queries.actors({
+        tenant,
+        limit,
+        actorType: type,
+        prefix,
+        after: afterType === undefined || afterId === undefined
+            ? undefined
+            : { actorType: afterType, actorId: afterId },
+    })));
+    yield* route("/actor", ActorParams, (tenant, { limit, type, id }) => Queries.actor({ tenant, limit, actorType: type, actorId: id }));
+    yield* route("/outbox", PageParams, (tenant, { limit }) => Effect.asSome(Queries.outbox({ tenant, limit })));
+    yield* route("/jobs", PageParams, (tenant, { limit }) => Effect.asSome(Queries.jobs({ tenant, limit })));
+    yield* route("/dead-letters", DeadLettersParams, (tenant, { limit, afterDeadAtMs, afterJobId }) => Effect.asSome(Queries.deadLetters({
+        tenant,
+        limit,
+        after: afterDeadAtMs === undefined || afterJobId === undefined
+            ? undefined
+            : { deadAtMs: afterDeadAtMs, jobId: afterJobId },
+    })));
+    yield* route("/workflows", WorkflowsParams, (tenant, { limit, status, afterStartedAtMs, afterExecutionId }) => Effect.asSome(Queries.workflows({
+        tenant,
+        limit,
+        status: status ?? "open",
+        after: afterStartedAtMs === undefined || afterExecutionId === undefined
+            ? undefined
+            : { startedAtMs: afterStartedAtMs, executionId: afterExecutionId },
+    })));
+    yield* route("/actor-types", ActorTypesParams, (tenant, { limit, type, prefix, after }) => Effect.asSome(Queries.actorTypes({ tenant, limit, name: type, prefix, after })));
+    yield* route("/job-types", JobTypesParams, (tenant, { limit, after }) => Effect.asSome(Queries.jobTypes({ tenant, limit, after })));
+    yield* route("/receipts", ReceiptsParams, (tenant, { limit, type, id, outcome, afterExpiresAtMs, afterType, afterId, afterCommandId }) => Queries.receipts({
+        tenant,
+        limit,
+        actorType: type,
+        actorId: id,
+        outcomeTag: outcome,
+        after: afterExpiresAtMs === undefined ||
+            afterType === undefined ||
+            afterId === undefined ||
+            afterCommandId === undefined
+            ? undefined
+            : {
+                expiresAtMs: afterExpiresAtMs,
+                actorType: afterType,
+                actorId: afterId,
+                commandId: afterCommandId,
+            },
+    }));
+    yield* route("/latest-events", LatestEventsParams, (tenant, { limit, type, id, after }) => Queries.latestEvents({ tenant, limit, actorType: type, actorId: id, after }));
+    yield* route("/timeline", TimelineParams, (tenant, { limit, type, id, beforeSequence, beforeKind }) => Queries.timeline({
+        tenant,
+        limit,
+        actorType: type,
+        actorId: id,
+        before: beforeSequence === undefined || beforeKind === undefined
+            ? undefined
+            : { sequence: beforeSequence, kind: beforeKind },
+    }));
+}));
+/** The read-only inspector: `serve` mounts its routes. */
+export const Inspector = { serve };